I want to redirect all HTTP and HTTPS traffic to
squid acting as a transparent proxy. This traffic will then be blocked or authorized (in bulk) during certain hours. Specifically I do not want to decrypt/reencrypt HTTPS traffic but push it as it.
The HTTP part works, a
REDIRECT rule in
shorewall transfers all traffic intended for destination port
80 to the listening
3128 squid port in
The same trick for port
443 does not work.
There are tutorials on how to set up transparent proxy for HTTPS traffic, but all the ones I found describe the creation of a certifcate pair to decrypt/reencrypt the traffic - something I do not want to do.
The squid wiki mentions CONNECT as a way to tunnel HTTPS traffic, but adding
http_access allow CONNECT all to the configuration (and disabling the default
deny) does not change anything.
Therefore: is there a way to configure
squid so that HTTPS traffic rerouted to it via
iptables is then transparently transferred, without any modification?
(I would just eventually block when some time rules are met (this is to say the the block is not going to be based on anything within the HTTPS stream itself))